PT-2019-13399 · Medtronic · Medtronic Valleylab Ft10 Energy Platform+1

Published 2019-11-08 · Updated 2020-10-09 · CVE-2019-13535

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Medtronic Valleylab FT10 Energy Platform versions 2.1.0 and lower Medtronic Valleylab FT10 Energy Platform version 2.0.3 and lower Valleylab LS10 Energy Platform versions 1.20.2 and lower

Description The issue concerns the RFID security mechanism, which fails to apply read protection. This allows for full read access of the RFID security mechanism data.

Recommendations For Medtronic Valleylab FT10 Energy Platform versions 2.1.0 and lower, consider restricting access to the RFID security mechanism until a fix is available. For Medtronic Valleylab FT10 Energy Platform version 2.0.3 and lower, restrict access to the RFID security mechanism until a fix is available. For Valleylab LS10 Energy Platform versions 1.20.2 and lower, restrict access to the RFID security mechanism until a fix is available.

Fix

Incorrect Permission

Protection Mechanism Failure

Weakness Enumeration

CWE-732

CWE-693

Related Identifiers

CVE-2019-13535

Affected Products

Medtronic Valleylab Ft10 Energy Platform

Valleylab Ft10 Energy Platform

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-13535 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13535 · Vendor Advisory
• https://cisa.gov/news-events/ics-medical-advisories/icsma-19-311-01 · Note
• https://us-cert.gov/ics/advisories/icsma-19-311-01 · Note
• https://global.medtronic.com/xg-en/product-security/security-bulletins/valleylab-generator-rfid-vulnerabilities.html · Note